Junior Security Operations Center Analyst (L1)

CloudMile; Jakarta Pusat; On-site; IDR 78,120,000 - 133,920,000; Full time

Job summary

CloudMile is seeking an SOC Analyst L1 to monitor and respond to security events across client environments. Open to fresh graduates and early-career professionals aiming to deepen SOC and SIEM hands-on expertise.

You will work with senior analysts and the SOC Lead, primarily using Google SecOps and other modern security tools, gaining exposure to real incidents and structured incident response processes.

Qualifications

• Fresh graduates or professionals with up to 1–2 years of cybersecurity experience.
• Fundamental understanding of SOC concepts (SIEM, incident response, alert triage).
• Familiar with SIEM platforms; Google SecOps is a strong plus.
• Networking fundamentals (TCP/IP, DNS, HTTP/S).
• Windows and Linux operating systems knowledge.
• Willingness to work in 24/7 SOC shifts.
• Strong analytical thinking and clear communication of findings.

Responsibilities

• Monitor, analyze, and validate alerts from Google SecOps and security tools.
• Triage alerts and perform initial investigations.
• Escalate incidents to SOC L2 with analysis and evidence.
• Analyze logs from endpoints, servers, and cloud devices.
• Execute SOC SOPs and incident response playbooks.
• Document investigation notes, timelines, and reports.
• Stay informed on attack techniques and indicators of compromise.
• Participate in 24/7 shift operations, including nights/weekends.

Skills

SIEM experience

Cybersecurity basics

English proficiency

Bahasa Indonesia

Tools

Google SecOps

Splunk

QRadar

Job description

As a Security Operations Center (SOC) Analyst L1, you will serve as the first line of defense in detecting and responding to security threats across our client environments. This role is open to fresh graduates who are passionate about cybersecurity, as well as early-career or experienced professionals who want to deepen their hands‑on SOC and SIEM expertise.

You will work closely with senior analysts and the SOC Lead while operating primarily on Google Security Operations (SecOps) and other modern security platforms. This role offers strong exposure to real-world incidents, structured processes, and continuous learning in a production SOC environment.

Key Responsibilities:

• Security Monitoring: Monitor, analyze, and validate alerts generated from Google Security Operations (SecOps) and supporting security tools.
• Alert Triage & Investigation: Perform initial investigation to assess alert severity, context, and potential impact.
• Incident Escalation: Escalate confirmed incidents or suspicious activity to SOC L2 / SOC Lead with clear analysis and supporting evidence.
• Log & Event Analysis: Analyze logs from endpoints, servers, network devices, and cloud environments.
• Playbook Execution: Execute SOC SOPs and incident response playbooks consistently and accurately.
• Case Documentation: Create and maintain investigation notes, incident timelines, and reports.
• Threat Awareness: Stay informed on common attack techniques, indicators of compromise, and emerging threats.
• Shift Operations: Participate in shift-based SOC operations, including possible night or weekend rotations.

Requirements:

• Fresh graduates or professionals with up to 1–2 years of experience in cybersecurity, SOC, IT operations, or related roles.
• Fundamental understanding of cybersecurity and SOC concepts (SIEM, incident response, alert triage).
• Experience or familiarity with SIEM platforms - Google Security Operations (SecOps) is a strong plus; experience with other SIEMs (Splunk, QRadar, Elastic, Sentinel, etc.) is also acceptable.
• Working knowledge of:
• Networking fundamentals (TCP/IP, DNS, HTTP/S)
• Operating systems (Windows and Linux.
• Common threat types (phishing, malware, brute-force attacks, suspicious logins)
• Willingness to work in shifts and operate in a 24/7 SOC environment.
• Ability to follow procedures, think analytically, and communicate findings clearly.
• Good command of Bahasa Indonesia and English (for alerts, documentation, and collaboration).

Nice to Have (Plus Points):

• Hands‑on experience with Google Security Operations (SecOps / Chronicle).
• Familiarity with the MITRE ATT&CK framework.
• Exposure to cloud environments (especially GCP, but AWS/Azure are also valuable).
• Security certifications or ongoing study (Security+, Google Cloud Security, Blue Team labs, etc.).
• Previous internship, SOC rotation, or hands‑on lab experience in security monitoring.